OCTAVE CASENET Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A hospital network is conducting an OCTAVE assessment. The team has completed the organizational view, identifying electronic health records (EHR) as the most critical asset. In the technological view, they discovered that the EHR system has multiple unpatched vulnerabilities and that the network segmentation between the EHR and the guest Wi-Fi is weak. The team must now develop a mitigation strategy. Which approach best balances the need to protect the EHR with the operational need to keep the system available?

   • APrioritize patching the most critical vulnerabilities and strengthening network segmentation, while scheduling patches during maintenance windows to minimize downtime.
   • BFocus only on network segmentation because it is less disruptive than patching.
   • CAccept the risk because the EHR system is critical and cannot be taken offline.
   • DImmediately take the EHR system offline to patch all vulnerabilities, regardless of impact on patient care.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A financial services firm is starting an OCTAVE assessment. The security lead wants to begin by identifying which information assets are most critical to the organization's mission. According to OCTAVE, what should the assessment team do first?

   • ARun a network vulnerability scanner across all production subnets to enumerate technical weaknesses.
   • BInterview senior managers and operational staff to catalog the organization's important information assets and their relative value.
   • CSelect a set of threat models such as STRIDE and apply them to each business process.
   • DDevelop a risk mitigation plan that prioritizes controls for the most likely threat scenarios.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an OCTAVE assessment, a hospital identifies patient health records as a critical asset. The team is now evaluating threats to this asset. Which threat scenario should be prioritized?

   • AA natural disaster destroys the hospital's data center, causing temporary unavailability of records.
   • BA competitor uses social engineering to learn about the hospital's marketing strategy.
   • CAn employee accidentally deletes a backup tape containing archived records.
   • DAn external attacker exploits a vulnerability in the patient portal to access and exfiltrate health records.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the OCTAVE methodology, what is the purpose of identifying threats to critical assets?

   • ATo assign a monetary value to each threat
   • BTo create a list of all possible vulnerabilities in the system
   • CTo understand the sources, motivations, and potential impacts of threats
   • DTo determine the exact likelihood of each threat occurring
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the goal of the mitigation strategy phase in OCTAVE?

   • ATo identify all critical assets of the organization
   • BTo assess the likelihood of threat scenarios
   • CTo implement security controls immediately
   • DTo develop plans to reduce identified risks to acceptable levels
   Reveal Solution Discussion Select an answer first